@huynle/hub 0.9.2 → 0.10.1

package/src/central/http.ts

@@ -8,7 +8,7 @@ import { diskAssets, type WebAssets } from "./assets"
 import path from "node:path"
 import { promisify } from "node:util"
 import { brotliCompress, constants as zlib, gzip } from "node:zlib"
-import { formAnswerProblem, isPreviewPath, parseMediaAllowlist, parseMediaRef, PREVIEW_BUNDLE_LIMITS, NOT_A_USER_MESSAGE, RECORDING_AUDIO_RESULT_HEADER, REVERT_BUSY, REVERT_END_BUSY, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, redactEmbeddedMedia, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage, type ResultFor } from "../protocol"
+import { CONNECT_PATHS, formAnswerProblem, isDeliverResult, isPreviewPath, parseMediaAllowlist, parseMediaRef, PREVIEW_BUNDLE_LIMITS, NOT_A_USER_MESSAGE, RECORDING_AUDIO_RESULT_HEADER, REVERT_BUSY, REVERT_END_BUSY, PROMPT_IMAGE_MIMES, WORKSPACE_LIMITS, promptImagesProblem, redactEmbeddedMedia, type AvailableModel, type CoreOp, type EnrollStart, type FormAnswer, type ModelSelection, type PermissionDecision, type PromptImage, type ResultFor, type SessionModelPrefs } from "../protocol"
 import { isLoopbackAddress, isLoopbackHost, isLoopbackURL, loopbackOrigins } from "../loopback"
 import { speakable } from "../speakable"
 import { Auth, RateLimitError, ValidationError } from "./auth"
@@ -22,7 +22,11 @@ import { createUnfurl } from "./media-unfurl"
 import { createFetchBudget } from "./fetch-budget"
 import { createTimelineMedia } from "./media-timeline"
 import { Webhooks } from "./agent/webhooks"
-import { issueAppToken } from "./agent/app-tokens"
+import { subscriptionActor, Subscriptions } from "./agent/subscriptions"
+import { subscriptionResolver } from "./agent/subscription-routes"
+import { APP_SCOPES, issueAppToken } from "./agent/app-tokens"
+import { AppConnect } from "./agent/connect"
+import { clientAddress } from "./client-address"
 import { AGENT_EVENTS_AGE_MS, AGENT_EVENTS_MAX, AgentEvents, archiveEvent, conciergeEvent, type AgentEvent } from "./agent/events"
 import { EventWriters } from "./agent/event-writers"
 import { MemoryEventLog } from "./backend/memory-events"
@@ -36,6 +40,7 @@ import { ANSWER_VIAS, type AnswerVia, Decisions, type Decision, TAP_ONLY } from
 import { Acting, type Escalate } from "./agent/acting"
 import { Escalations } from "./agent/escalation"
 import { GrantRequests } from "./agent/grant-requests"
+import { ConciergeGrantRequests, conciergeGrantRequestRoutes, watchedProjects } from "./concierge/grant-request"
 import { partyFromActor } from "./agent/envelope"
 import { Delivery } from "./agent/delivery"
 import { AGENT_ERROR_STATUS, AgentError, type AgentErrorCode } from "./agent/errors"
@@ -45,12 +50,14 @@ import { hubDirectory } from "./agent/directory-routes"
 import type { Directory } from "./agent/directory"
 import { installResponse } from "./install/render"
 import { agentApi, agentRoutes, agentVerifiers, isAgentPath, wellKnown, type AgentRoute } from "./agent/routes"
+import type { AppSpeech } from "./agent/speech-routes"
 import { MCP_PATH, mcpHttp } from "./mcp-http"
 import { SessionTokens } from "./agent/session-tokens"
 import { SessionTokenPush } from "./session-token-push"
 import { TokenKeys } from "./token-keys"
 import { EventLog } from "./events-log"
-import { BusyError, Registry, type Timers } from "./registry"
+import { BusyError, Registry, RELAY_REASON, RelayRefused, type Timers } from "./registry"
+import { RELAY_REASON_CONFIRMED, relayMessage, relayQuestionProblem, STATUS_QUESTION_SOFT_REFUSAL } from "./front-relays"
 import { createActions, type Unsupported, unsupportedMessage } from "./actions"
 import { IntentRetention, SessionIntents, withPromptIntents } from "./agent/intents"
 import { audioFormat, SpeechError } from "./speech/provider"
@@ -95,11 +102,17 @@ import { TeamStaffingService } from "./teams/staffing"
 import { intakeActor, TeamIntakeService } from "./teams/intake"
 import { TeamStore } from "./teams/store"
 import { ActivityTracker } from "./concierge/activity"
+import { HumanActivity, withHumanActivity } from "./human-activity"
 import { ResultTracker } from "./concierge/board-results"
 import { BoardRevisions } from "./concierge/board"
 import { conciergeBoard } from "./concierge/board-routes"
+import { renderFrontBoard } from "./concierge/board-render"
 import { ContextPusher } from "./concierge/context"
 import { C1_ENTITLEMENTS } from "./concierge/entitlements"
+import { ContextCardService, contextCardEvent, type AutoTrigger } from "./context-cards/service"
+import { TRANSCRIPT_ROWS } from "./context-cards/inputs"
+import { CONTEXT_CARD_TRIGGERS } from "./../protocol"
+import type { ChatClient } from "./llm/chat"
 import { conciergeActor, conciergeInbound, conciergeProtects } from "./concierge/inbound"
 import { conciergeModules, type ConciergePorts, type ConciergeTiers } from "./concierge/index"
 import { watchedSessions } from "./concierge/notifier"
@@ -113,11 +126,16 @@ import { CONCIERGE_TAMPERED, isConciergeLaunch, recordIdentity, StatusStore, Sup
 import { CONCIERGE_AGENT } from "../../packages/protocol/src/concierge"
 import { CONCIERGE_FORCED_PUSH_MS, INTERNAL_AGENTS, KNOWN_PRIMARY_AGENTS } from "./concierge/context"
 import { grantState } from "./agent/grants"
-import { catalogHarnesses, TeamDiscovery } from "./teams/discovery"
+import { AppStreams, MAX_UTTERANCE_CHARS, type ConversationPorts, type StreamSource } from "./agent/conversation"
+import { newMessageID } from "./agent/messages"
+import { catalogHarnesses, eventVisibility, TeamDiscovery } from "./teams/discovery"
 import { inRevertWindow, RevertWindows } from "./revert-windows"
 import { DRAIN_RETRY_AFTER_MS, DRAIN_TIMEOUT_MS, RequestTimeoutError, RequestTooLargeError, SpokeError, SpokeHub, type DrainOptions, type Notifier, type SpokeHubOptions, type SpokeSocketData } from "./spoke-ws"
 import { ACTIVITY_INTERVAL_MAX, ACTIVITY_INTERVAL_MIN, LOCAL_USER, PUSH_PREF_KEYS, quietHoursInput, Store, VIEW_PREF_KEYS, VIEW_PREF_MAX_ARCHIVED, type DeviceRecord, type LegacyPushPrefs, type PushPrefs, type UserRecord, type ViewPrefs } from "./store"
 
+/** How long shutdown waits for buffered session activity to be written (HumanActivity.stop). */
+const HUMAN_ACTIVITY_STOP_MS = 3_000
+
 export interface Speech {
   transcribe(audio: Uint8Array, format: string): Promise<string>
   speak(text: string): Promise<Uint8Array<ArrayBuffer>>
@@ -151,8 +169,12 @@ export interface CentralOptions {
   readonly now?: () => number
   /** Shared state for new code (default: in memory, see ./backend). */
   readonly backends?: Backends
+  /** Context cards: a fake model client and the trigger debounce (tests). */
+  readonly contextCards?: { readonly chat?: ChatClient; readonly debounceMs?: number }
   /** More bearer verifiers and /api/agent routes, after the built-in ones (tests). */
   readonly agent?: { readonly verifiers?: readonly BearerVerifier[]; readonly routes?: readonly AgentRoute[] }
+  /** (AF3) App conversation streams: heartbeat, re-check interval and unsent-bytes limit (tests shorten them). */
+  readonly appStreams?: { readonly heartbeatMs?: number; readonly recheckMs?: number; readonly bufferMaxBytes?: number }
   readonly timing?: {
     readonly helloTimeoutMs?: number
     readonly requestTimeoutMs?: number
@@ -162,6 +184,10 @@ export interface CentralOptions {
     /** (S4 M3) The longest one timeline image may take from the spoke, all chunks together (default 60 s). */
     readonly mediaDeadlineMs?: number
     readonly heartbeatMs?: number
+    /** (Session findability) How often buffered activity is checked for a due write (default 15 s). */
+    readonly humanActivityFlushMs?: number
+    /** (Session findability) At most one activity write per session per this long (default 60 s). */
+    readonly humanActivityWriteMs?: number
     readonly staleMs?: number
     /** Per node op request timeouts (see NODE_TIMEOUTS_MS). */
     readonly nodeTimeoutsMs?: SpokeHubOptions["nodeTimeoutsMs"]
@@ -210,6 +236,8 @@ export interface Central {
   readonly launchTokens: LaunchTokens
   /** Webhooks (P4-T10): registrations and the outbox sender; launch changes are published to it. */
   readonly webhooks: Webhooks
+  /** Session subscriptions (decision 74qawely): records and the leader's dispatcher (tests run a pass with tick). */
+  readonly subscriptions: Subscriptions
   /** The canonical agent event journal (GET /api/agent/events, MCP events): compact events per user, 24 h / 10,000. */
   readonly agentEvents: AgentEvents
   /** The agent directory (names, roles, address resolution). */
@@ -220,6 +248,8 @@ export interface Central {
   readonly agentEventWriters: EventWriters
   /** (CON-02) Session intent retention (its leader runs it every 6 h; tests run a pass with runOnce). */
   readonly intentRetention: IntentRetention
+  /** Context cards (decision 9604b0a1; docs/context-cards.md): providers, engine, store, budget, settings. */
+  readonly contextCards: ContextCardService
   /** (REC-01) Voice & Concierge recordings (developer): the owner-only store, taps, export and retention. */
   readonly recordings: RecordingService
   /** The JSON API's route table (method, path, access), for audits and tests. */
@@ -350,7 +380,7 @@ const VIEW_PREF_MAX_ENTRIES = 500
 const VIEW_PREF_MAX_CHARS = 4096
 const DECISIONS = new Set<PermissionDecision>(["once", "always", "reject"])
 /** Longest utterance accepted for conversation mode (characters, after trimming). */
-export const MAX_UTTERANCE_CHARS = 4000
+export { MAX_UTTERANCE_CHARS }
 /** Longest typed prompt or steer accepted (characters, after trimming); a bigger one would not fit in a frame. */
 export const MAX_PROMPT_CHARS = 100_000
 /** The shell's answer when the hub has no built web app (e.g. the plugin installed from GitHub). */
@@ -366,6 +396,8 @@ const SPEECH_TEST_TEXT = "Hi! This is how I will sound when I read replies to yo
 const SPEECH_TEST_MAX_CHARS = 300
 // Primary-navigation destinations (web/src/app/nav.ts) and one sub-path level, plus legacy routes the console
 // redirects (birds-eye → watchtower, nav.ts LEGACY_ROUTES); test/central-web.test.ts checks the registry.
+/** (AF1) The consent page: the console's SPA, never framed. */
+const CONSENT_PAGE = /^\/connect\/consent\/hcf_[0-9a-f]{24}$/
 const APP_ROUTES = /^\/(?:|pair|approve|new|settings(?:\/[a-z-]+)?|panes|concierge(?:\/[^/]+)?|s\/[^/]+|(?:artifacts|teams|watchtower|birds-eye|profiles)(?:\/[^/]+)?)$/
 const STATIC_PATH = /^(?:\/[A-Za-z0-9_-][A-Za-z0-9._-]*)+$/
 /** Where a one-time sign-in link may land: home, or a session (with Voice mode starting: `?voice=1`). */
@@ -419,7 +451,9 @@ class HttpError extends Error {
 }
 
 /** A core op the session's spoke does not serve (another harness's spoke): 409 code unsupported, like plugin_outdated. */
-const unsupportedError = (lacking: { readonly feature: Unsupported["feature"] | "fork" | "revert"; readonly harness: string }) => new HttpError(409, unsupportedMessage(lacking), "unsupported")
+/** (AF3) The same, as an /api/agent error. */
+const unsupportedAgentError = (feature: string, harness: string) => new AgentError("unsupported", unsupportedMessage({ feature, harness }), { extra: { feature, harness } })
+const unsupportedError = (lacking: { readonly feature: Unsupported["feature"] | "fork" | "revert" | "setModel"; readonly harness: string }) => new HttpError(409, unsupportedMessage(lacking), "unsupported")
 
 const error = (status: number, message: string, code?: string, headers?: Record<string, string>) =>
   Response.json({ error: message, ...(code ? { code } : {}) }, { status, ...(headers ? { headers } : {}) })
@@ -454,6 +488,8 @@ export function startCentral(options: CentralOptions): Central {
   const notifier = conciergeAwareNotifier(options.notifier ?? push, () => conciergeIdentity)
   /** SSE subscribers, one user each. */
   const listeners = new Set<Listener>()
+  /** (AF3) Open app conversation streams of this process: caps and revocation pulses. */
+  const appStreams = new AppStreams()
   /** Recent messages per user, replayed to a stream that reconnects with Last-Event-ID. */
   const eventLog = new EventLog()
   /** Whether a listener wants a message (lite streams skip other sessions' streamed text). */
@@ -582,6 +618,29 @@ export function startCentral(options: CentralOptions): Central {
   const secure = publicURL.startsWith("https:")
 
   auth = new Auth({ store, publicURL, now, mode: config.auth.mode, kv: backends.kv, counters: backends.counters })
+  // (AF1) Connect an app: registered clients, the consent flow, connected-app tokens. Ending a connection deletes the
+  // grants it holds and the webhooks it registered (app:<connection>); its launches keep running.
+  const appConnect = new AppConnect({
+    store,
+    kv: backends.kv,
+    counters: backends.counters,
+    publicURL: () => publicURL,
+    scopes: APP_SCOPES,
+    now,
+    ended: async (userID, connectionID) => {
+      const holder = `app:${connectionID}` as const
+      for (const grant of await grants.list(userID)) if (grant.holder === holder && grant.state === "active") await grants.revoke(userID, grant.id)
+      for (const hook of await webhooks.list(userID, holder)) await webhooks.remove(userID, hook.id, holder)
+      // (AF3) Its open streams end now (end revoked).
+      appStreams.pulse(userID)
+    },
+  })
+  /** The client address for per-address limits (HUB_TRUSTED_PROXIES: client-address.ts). */
+  const trustedProxies = parseDenyCidrs((config.trustedProxies ?? []).join(","), "HUB_TRUSTED_PROXIES")
+  const addressOf = (request: Request, server: Server<SpokeSocketData>) => clientAddress(request, server.requestIP(request)?.address, trustedProxies)
+  /** An app credential of the user: a hand-made token or a connected app (launch flags, webhooks, grants). */
+  const appCredential = (userID: string, id: string) => (store.agentData(userID).appTokens ?? []).some((t) => t.id === id) || appConnect.alive(userID, id)
+  const appCredentialScopes = (userID: string, id: string) => store.agentData(userID).appTokens?.find((t) => t.id === id)?.scopes ?? appConnect.scopesOf(userID, id)
   // options.fetch is for speech providers only; sign-in always talks to the real issuer.
   const oidc = config.auth.mode === "oidc" ? new OidcClient({ config: config.auth, publicURL, now, kv: backends.kv, counters: backends.counters }) : undefined
   /** Speech settings scope of a user: "local" (pairing mode) uses the server default directly. */
@@ -608,6 +667,8 @@ export function startCentral(options: CentralOptions): Central {
     ...options.timing,
   })
   spokes.ready().catch((cause) => console.error(`[hub] cluster routing did not start: ${(cause as Error).message}`))
+  // (voice front P2) The Concierge front's relays: checked and run by the hub (relayToSession below).
+  spokes.relayToSession = (owner, connID, req) => relayToSession(owner, connID, req)
   // Cluster mode: this pod publishes its connections (spokes and nodes) per user and mirrors the other pods', so the
   // registries' reads cover the whole cluster (design §9).
   const view = config.cluster
@@ -926,6 +987,19 @@ export function startCentral(options: CentralOptions): Central {
     }
   })
   registry.onHumanTurn((sessionID) => void humanTurn(sessionID))
+  // (Session findability, decision iaspcry7) "Touched by me" and the activity meter: per user, per session; the
+  // owner's consoles get each change as {type: "activity", sessionID, activity}.
+  const humanActivity = new HumanActivity({
+    state: backends.state,
+    now,
+    ...(options.timing?.humanActivityFlushMs !== undefined ? { flushEveryMs: options.timing.humanActivityFlushMs } : {}),
+    ...(options.timing?.humanActivityWriteMs !== undefined ? { writeEveryMs: options.timing.humanActivityWriteMs } : {}),
+    onChange: (userID, sessionID, activity) => broadcast({ type: "activity", sessionID, activity }, { tenant: userID }),
+  })
+  // A prompt typed in the terminal (exact: what the hub carried is marked so, see Registry.onTerminalPrompt).
+  registry.onTerminalPrompt((rootID, tenant) => humanActivity.human(tenant, rootID, "prompt-tui"))
+  registry.onAgentWork((rootID, tenant, what) => humanActivity.agent(tenant, rootID, what))
+  humanActivity.start()
   // (S4 M3) Timeline images, cached per user on this pod; a deleted session or a committed revert forgets them.
   const timelineMedia = createTimelineMedia({
     request: (connID, req) => spokes.request(connID, req),
@@ -940,9 +1014,12 @@ export function startCentral(options: CentralOptions): Central {
       timelineMedia.forgetSession(sessionID)
     }
   })
-  registry.onSessionDeleted((sessionID) => {
+  registry.onSessionDeleted((sessionID, tenant) => {
     mediaRevertCommits.delete(sessionID)
     timelineMedia.forgetSession(sessionID)
+    // (AF3) Its app streams end now (gone); the directory remembers it for every pod (their re-checks, new connects).
+    appStreams.deleted(tenant, sessionID)
+    void directory.markDeleted(tenant, sessionID).catch((cause) => console.error(`[hub] directory delete mark failed: ${(cause as Error).message}`))
   })
   // (CON-02) Session intents; the journal is created below (appends happen only once requests arrive).
   const intents = new SessionIntents({
@@ -956,14 +1033,17 @@ export function startCentral(options: CentralOptions): Central {
    * Permission, form, prompt and stop execution, shared by the console routes and the agent act verbs. Every
    * prompt the hub carries derives the session's intent once (CON-02).
    */
-  const actions = withPromptIntents(createActions({
+  const actions = withHumanActivity(withPromptIntents(createActions({
     registry,
     spokes,
     humanTurn,
     kv: backends.kv,
     // Cluster mode: a turn also holds the session's lease, so two pods never start turns in it at once.
     ...(config.cluster ? { turns: { locks: backends.locks, owner: leaseOwner, ttlMs: config.turnTimeoutMs + TURN_LEASE_SLACK_MS } } : {}),
-  }), intents, (sessionID) => registry.sessionTenant(sessionID), (sessionID) => registry.session(sessionID)?.title)
+  }), intents, (sessionID) => registry.sessionTenant(sessionID), (sessionID) => registry.session(sessionID)?.title), humanActivity, {
+    tenant: (sessionID) => registry.sessionTenant(sessionID),
+    root: (sessionID) => registry.rootOf(sessionID) ?? sessionID,
+  })
   leader("delivery", { onElected: () => delivery.start(), onDeposed: () => delivery.stop() })
   // Launches (design §6): placement onto the user's nodes, prepare on the node, the session through the machine's
   // service spoke, then its end; restart recovery runs on start. Every change goes to launchFeed: the owner's
@@ -1006,7 +1086,7 @@ export function startCentral(options: CentralOptions): Central {
     ...(options.timing?.launchSettleMs !== undefined ? { settleMs: options.timing.launchSettleMs } : {}),
     ...(options.timing?.launchTickMs !== undefined ? { tickMs: options.timing.launchTickMs } : {}),
     // FX-02: a launch of a revoked app token (`app:<16 hex>` no longer among the user's tokens) is flagged, not stopped.
-    launchers: { revoked: (userID, by) => /^app:[0-9a-f]{16}$/.test(by) && !(store.user(userID)?.agent?.appTokens ?? []).some((t) => `app:${t.id}` === by) },
+    launchers: { revoked: (userID, by) => /^app:[0-9a-f]{16}$/.test(by) && !appCredential(userID, by.slice(4)) },
     profiles: { applyAtLaunch: async (userID, sessionID, ref) => (profileApplier ? profileApplier.applyAtLaunch(userID, sessionID, ref) : [`profile ${ref.profileID} v${ref.version} not applied: the hub is starting`]) },
     // Cluster mode: the supervisor runs on the launches leader; other pods kick it and send it their stops.
     ...(config.cluster
@@ -1062,8 +1142,11 @@ export function startCentral(options: CentralOptions): Central {
     resolve: options.resolveHost ?? systemResolveHost,
     ...(config.webhooksAllowPrivate ? { allowPrivate: true } : {}),
     ...(config.webhooksPrivateHosts?.length ? { privateHosts: config.webhooksPrivateHosts } : {}),
-    appAlive: (userID, tokenID) => store.agentData(userID).appTokens?.some((t) => t.id === tokenID && Array.isArray(t.scopes) && WEBHOOK_APP_SCOPES.some((scope) => t.scopes!.includes(scope))) === true,
-    appScopes: (userID, tokenID) => store.agentData(userID).appTokens?.find((t) => t.id === tokenID)?.scopes,
+    appAlive: (userID, tokenID) => {
+      const scopes = appCredentialScopes(userID, tokenID)
+      return Array.isArray(scopes) && WEBHOOK_APP_SCOPES.some((scope) => scopes.includes(scope))
+    },
+    appScopes: appCredentialScopes,
     userAgent: `hub/${options.version ?? "0.0.0"}`,
   })
   const webhookLeader = leader("webhooks", {
@@ -1076,16 +1159,20 @@ export function startCentral(options: CentralOptions): Central {
   let teamIntake: TeamIntakeService | undefined // HWA-36: drains queued intake on staffing/presence events (below)
   /** (CON-04) Journal appends for the Concierge (context refresh, CON-05's notifier); set once the service exists. */
   let conciergeOnAppend: ((userID: string, event: AgentEvent) => void) | undefined
+  /** Session subscriptions (set below, once team discovery exists): matching appends schedule a pass. */
+  let subscriptions: Subscriptions | undefined
   // CON-01: the Concierge watchlist's lastActiveAt per session, from appends (best effort, never awaited; observe never
   // rejects, and the catch keeps it that way: an unhandled rejection would end the process).
   const conciergeActivity = new ActivityTracker({ state: backends.state, now })
   // CON-03: the board's last result per root session, from appends (best effort, as above).
   const conciergeResults = new ResultTracker({ state: backends.state, now })
+  /** Context cards (set below, once intents and the journal exist); journal appends trigger them. */
+  let contextCards: ContextCardService | undefined
   const agentEvents = new AgentEvents({
     log: backends.agentEvents ?? new MemoryEventLog({ now, max: AGENT_EVENTS_MAX, maxAgeMs: AGENT_EVENTS_AGE_MS }),
     kv: backends.kv,
     now,
-    onAppend: (userID, record) => (void teamIntake?.onEvent(userID, record.event), conciergeOnAppend?.(userID, record.event), void conciergeActivity.observe(userID, record.event).catch(() => {}), void conciergeResults.observe(userID, record.event).catch(() => {}), webhooks.publishCanonical(userID, record.event, record.family, record.audience).then((queued) => (queued && !webhookLeader.isLeader() ? webhookLeader.kick() : undefined))),
+    onAppend: (userID, record) => (void teamIntake?.onEvent(userID, record.event), contextCards?.onEvent(userID, record.event), subscriptions?.observe(userID, record.event), conciergeOnAppend?.(userID, record.event), void conciergeActivity.observe(userID, record.event).catch(() => {}), void conciergeResults.observe(userID, record.event).catch(() => {}), webhooks.publishCanonical(userID, record.event, record.family, record.audience).then((queued) => (queued && !webhookLeader.isLeader() ? webhookLeader.kick() : undefined))),
   })
   const agentEventWriters = new EventWriters({
     events: agentEvents,
@@ -1145,6 +1232,58 @@ export function startCentral(options: CentralOptions): Central {
   })
   leader("session-intents", { onElected: () => intentRetention.start(), onDeposed: () => intentRetention.stop() })
   if (artifactMaintenance) leader("artifacts", { onElected: () => artifactMaintenance.start(), onDeposed: () => artifactMaintenance.stop() })
+  // Context cards (decision 9604b0a1; docs/context-cards.md): the hub calls a light model for a per-session
+  // pick-up card. Automatic runs happen on the "context-cards" leader (other pods forward their triggers to it).
+  const ownSession = (userID: string, sessionID: string) => registry.sessionTenant(sessionID) === userID
+  const cards = new ContextCardService({
+    state: backends.state,
+    config: config.contextCards ?? {},
+    keySources: () => ({ ...(config.apiKey ? { envKey: config.apiKey } : {}), speech: [store.speechSettings(), ...(config.speech ? [config.speech] : [])] }),
+    ...(options.contextCards?.chat ? { chat: options.contextCards.chat } : {}),
+    ...(options.fetch ? { fetch: options.fetch } : {}),
+    inputs: {
+      session: (userID, sessionID) => (ownSession(userID, sessionID) ? registry.session(sessionID) : undefined),
+      intent: async (userID, sessionID) => (await intents.read(userID, sessionID))?.text,
+      timeline: async (userID, sessionID) => {
+        if (!ownSession(userID, sessionID)) return []
+        const page = (await spokes.request(ownerOf(sessionID), { op: "timeline", sessionID, limit: TRANSCRIPT_ROWS, order: "desc" })) as { items?: unknown[] }
+        return page?.items ?? []
+      },
+      summary: async (userID, sessionID) => (ownSession(userID, sessionID) ? spokes.request(ownerOf(sessionID), { op: "summary", sessionID }) : undefined),
+    },
+    isLeader: () => cardsLeader.isLeader(),
+    forward: (userID, sessionID, trigger, humanAt) => void cardsLeader.kick({ userID, sessionID, trigger, ...(humanAt !== undefined ? { humanAt } : {}) }),
+    onCard: (userID, card) => {
+      broadcast({ type: "contextCard", sessionID: card.sessionID, provider: card.provider, ...(card.primary ? { primary: true } : {}), generatedAt: card.generatedAt }, { tenant: userID })
+      void agentEvents.append(userID, contextCardEvent(card)).catch((cause) => console.error(`[hub] session.contextCard event failed: ${(cause as Error).message}`))
+    },
+    autoName: async (userID, sessionID) => {
+      if (ownSession(userID, sessionID)) await autoName(sessionID)
+    },
+    // A session deleted while its card was made gets none (the directory marks it; the registry may still list it).
+    exists: async (userID, sessionID) => !(store.agentData(userID).sessions ?? []).some((s) => s.sessionID === sessionID && s.deletedAt !== undefined),
+    title: (userID, sessionID) => (ownSession(userID, sessionID) ? registry.session(sessionID)?.title : undefined),
+    // (Session findability) The automatic cards' gate: the persisted human activity of the root session.
+    lastHumanAt: (userID, sessionID) => humanActivity.lastAt(userID, registry.rootOf(sessionID) ?? sessionID),
+    users: allUsers,
+    now,
+    ...(options.contextCards?.debounceMs !== undefined ? { debounceMs: options.contextCards.debounceMs } : {}),
+  })
+  contextCards = cards
+  const cardsLeader = leader("context-cards", {
+    onElected: () => cards.start(),
+    onDeposed: () => cards.stop(),
+    onKick: (message) => {
+      const m = (message ?? {}) as Record<string, unknown>
+      const trigger = m.trigger as AutoTrigger
+      if (typeof m.userID !== "string" || typeof m.sessionID !== "string" || !CONTEXT_CARD_TRIGGERS.includes(trigger) || (trigger as string) === "manual") return
+      cards.forwarded(m.userID, m.sessionID, trigger, typeof m.humanAt === "number" ? m.humanAt : undefined)
+    },
+  })
+  // User-return cards follow the user's own touches (typed or sent prompts, Voice, answers, explicit opens; rooted),
+  // never a prompt the hub carried for a launch or a Concierge proposal, nor the console's automatic read marks.
+  humanActivity.onTouch((userID, rootID) => cards.human(userID, rootID))
+  registry.onSessionDeleted((sessionID, tenant) => void cards.forget(tenant, sessionID).catch((cause) => console.error(`[hub] context card cleanup failed: ${(cause as Error).message}`)))
   for (const loop of leaders) void loop.start()
 
   // One credential resolver for every /api request: device cookie, device token, session and app tokens.
@@ -1179,7 +1318,7 @@ export function startCentral(options: CentralOptions): Central {
   registry.recordingTap = recordingService.registryTap
   registry.onSessionDeleted((sessionID, tenant) => void recordingService.sessionDeleted(tenant, sessionID).catch((cause) => console.error(`[hub] recording session end failed: ${(cause as Error).message}`)))
   void leader("voice-recordings", { onElected: () => recordingService.retention.start(), onDeposed: () => recordingService.retention.stop() }).start()
-  const grants = new Grants({ state: backends.state, counters: backends.counters, directory, store, admin: store, now, concierge: async (owner) => (await conciergeIdentity.current(owner)).hiddenSessionIDs })
+  const grants = new Grants({ state: backends.state, counters: backends.counters, directory, store, admin: store, now, concierge: async (owner) => (await conciergeIdentity.current(owner)).hiddenSessionIDs, connections: (owner, id) => appConnect.alive(owner, id), changed: (owner) => appStreams.pulse(owner) })
   const acting = new ActingSwitch({ store, never: config.agentsNever, audit })
   /** An agent as envelopes name it (a session by its directory name). */
   const describeActor = (userID: string, actor: AgentActor) => {
@@ -1221,6 +1360,8 @@ export function startCentral(options: CentralOptions): Central {
     now,
     describe: describeActor,
     published: (userID, message) => feed.publish(userID, message),
+    // (Concierge grant requests) A new @@concierge grant changes what the Concierge may do: refresh its context soon.
+    granted: (userID, grant) => void (grant.holder === "@@concierge" && conciergeTouch(userID, true)),
   })
   registry.onPermissionClosed((requestID, _sessionID, tenant) => {
     void escalations.closed(tenant, requestID).catch((cause) => console.error(`[hub] escalation close failed: ${(cause as Error).message}`))
@@ -1289,6 +1430,26 @@ export function startCentral(options: CentralOptions): Central {
   })
   void coordinatorLeader.start() // created after the other leaders were started
   const teamDiscovery = new TeamDiscovery({ teams: teamStore, seats: teamSeats, directory, harnesses: catalogHarnesses(registry) })
+  // Session subscriptions (decision 74qawely, docs/subscriptions.md): journal events of a subscriber's targets, batched
+  // into hub messages through Delivery (as app:subscriptions), from the `subscriptions` leader.
+  const subscriptionLeader = leader("subscriptions", { onElected: () => subscriptions?.start(), onDeposed: () => subscriptions?.stop() })
+  subscriptions = new Subscriptions({
+    state: backends.state,
+    events: agentEvents,
+    send: async (userID, sessionID, text, options) => void (await delivery.send(userID, subscriptionActor(userID), sessionID, "msg", text, options)),
+    hopDepth: (userID, sessionID) => delivery.hops.depth(userID, { kind: "session", sessionID }),
+    entries: (userID, sessionIDs) => directory.entries(userID, sessionIDs),
+    resolveTarget: subscriptionResolver(directory, teamDiscovery),
+    scope: async (userID, actor) => eventVisibility(await teamDiscovery.census(userID, actor)),
+    appAlive: (userID, tokenID) => store.agentData(userID).appTokens?.some((t) => t.id === tokenID && Array.isArray(t.scopes) && t.scopes.includes("events:subscribe")) === true,
+    // The Concierge admits messages from the user and its own services only (CON-04): it follows sessions through its watchlist.
+    refuseSubscriber: async (userID, sessionID) => ((await isConciergeSession(conciergeTimedIdentity, userID, sessionID)) ? "A Concierge session follows sessions through its watchlist, not subscriptions (hub watchlist watch <addr>)" : undefined),
+    users: allUsers,
+    isLeader: () => subscriptionLeader.isLeader(),
+    now,
+    ...(loopTickMs !== undefined ? { tickMs: loopTickMs, observeDelayMs: loopTickMs } : {}),
+  })
+  void subscriptionLeader.start() // created after the other leaders were started
 
   // ---- CON-04 the Concierge: settings, launch, supervise, hide, context ----
   const conciergeSettings = new SettingsStore(backends.state, now)
@@ -1305,12 +1466,30 @@ export function startCentral(options: CentralOptions): Central {
   let conciergeActing: Acting | undefined
   const conciergeCoverage = async (userID: string, conciergeSessionID: string, sessionID: string, requestID: string) =>
     conciergeActing ? conciergeActing.coverage({ userID, actor: { kind: "session", userID, machineID: "", sessionID: conciergeSessionID, via: "act" } }, sessionID, requestID) : { inGrant: false, auto: false }
-  const conciergeBoardDeps = { coverage: conciergeCoverage, identity: conciergeIdentity, state: backends.state, activity: conciergeActivity, directory, store, registry, decisions, labels: conciergeLabels, intents, results: conciergeResults, armed: conciergeArmed, timeZone: async (userID: string) => (await conciergeSettings.get(userID)).timeZone, now }
+  // (Concierge grant requests) The board's project-level inGrant: the verbs the current Concierge's grants allow there.
+  const conciergeProjectGrant = async (userID: string, conciergeSessionID: string, directory: string) => {
+    const actor = { kind: "session" as const, userID, machineID: "", sessionID: conciergeSessionID, via: "act" as const }
+    const verbs = ["approve", "deny", "answer", "prompt", "stop"] as const
+    const usable = await Promise.all(verbs.map((verb) => grants.usable(actor, verb, { directory })))
+    return verbs.filter((_, i) => usable[i]!.length > 0)
+  }
+  const conciergeBoardDeps = { cards, coverage: conciergeCoverage, projectGrant: conciergeProjectGrant, identity: conciergeIdentity, state: backends.state, activity: conciergeActivity, directory, store, registry, decisions, labels: conciergeLabels, intents, results: conciergeResults, armed: conciergeArmed, timeZone: async (userID: string) => (await conciergeSettings.get(userID)).timeZone, now }
   const conciergeRevisions = new BoardRevisions(backends.state)
+  // (Concierge grant requests) The Concierge asks for a scoped grant through the grant-request path (tap Decision).
+  const conciergeGrantRequests = new ConciergeGrantRequests({
+    requests: grantRequests,
+    grants,
+    settings: (userID) => conciergeSettings.get(userID),
+    watched: async (userID) => watchedProjects(conciergeBoardDeps, userID, (await conciergeIdentity.current(userID)).hiddenSessionIDs),
+  })
   const conciergeContext = new ContextPusher({
     registry,
     send: (connID, req) => spokes.request(connID, req),
-    board: async (userID) => (await conciergeBoard(conciergeBoardDeps, conciergeRevisions, userID, (await conciergeIdentity.current(userID)).hiddenSessionIDs)).rendered,
+    // (P2) The compact board for the Concierge's voice front goes along (to spokes that take it).
+    board: async (userID) => {
+      const view = await conciergeBoard(conciergeBoardDeps, conciergeRevisions, userID, (await conciergeIdentity.current(userID)).hiddenSessionIDs)
+      return { rendered: view.rendered, front: renderFrontBoard(view.board) }
+    },
     notes: conciergeNotes,
     settings: conciergeSettings,
     grant: async (userID, grantID) => {
@@ -1321,6 +1500,8 @@ export function startCentral(options: CentralOptions): Central {
         return undefined
       }
     },
+    // (Concierge grant requests) The @@concierge grants the user approved at its request (named after the grant line).
+    requested: async (userID) => (await grants.list(userID)).filter((g) => g.holder === "@@concierge"),
     // (CON-09a) Voice and voice confirm are in the instructions only when speech is set up for the user.
     voice: (userID) => options.speech !== undefined || !speechSettings.view(speechScope(userID)).ready.reason,
     now,
@@ -1511,7 +1692,59 @@ export function startCentral(options: CentralOptions): Central {
     onDeposed: () => (conciergeSupervisor.stop(), conciergeParts.notifier.stop()),
   })
   void conciergeLeader.start()
-  const agentDeps = { recording: { call: (userID: string, sessionID: string, fields: Parameters<RecordingService["conciergeCall"]>[2]) => recordingService.conciergeCall(userID, sessionID, fields) }, intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, messageState: backends.state, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeTimedIdentity, protects: conciergeProtects(conciergeTimedIdentity), service: conciergeService, models: machineModels({ serviceFor: (machineID) => registry.serviceFor(machineID), reportedSessions: (connID) => registry.reportedSessions(connID), request: (connID, req) => spokes.request(connID, req) }), routes: () => conciergeParts.tiers.routes(), armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage } }
+  /** (AF2) Speech for apps: the user's own speech (speechFor), never the recording taps (REC-01 off for apps). */
+  const appSpeech: AppSpeech = {
+    ready: (userID) => (options.speech ? { stt: true, tts: true } : speechSettings.ready(speechScope(userID))),
+    transcribe: (userID, audio, format) => speechFor(userID).transcribe(audio, format),
+    speak: (userID, text, signal) => speakAudio(speechFor(userID), text, signal),
+  }
+  const speechDeps = { speech: appSpeech, counters: backends.counters, maxAudioBytes: config.maxAudioBytes, maxSpeechChars: config.maxSpeechChars, ...(config.speechQuotas ? { quotas: config.speechQuotas } : {}), audit, now }
+  /**
+   * (AF3) The app conversation stream's events: this process's live stream (the console's listeners and EventLog,
+   * which keeps streamed text too) or, in a cluster, the live fan-out and the shared EventLog (no streamed text).
+   */
+  const appStreamSource: StreamSource = {
+    clustered: live !== undefined,
+    subscribe(userID, handler) {
+      if (live) {
+        const subscription = live.subscribe(userID, (event) => handler({ ...(event.id !== undefined ? { id: event.id } : {}), message: event.message }))
+        return { ready: subscription.ready, close: () => subscription.close() }
+      }
+      eventLog.open(userID)
+      const listener: Listener = {
+        userID,
+        // Never a device: no message is ever "not for" it.
+        deviceID: "",
+        lite: false,
+        send: (message, id) => {
+          if (message.type !== "catalog") handler({ ...(id !== undefined ? { id } : {}), message })
+        },
+        // The user was disabled or removed: the stream's re-check ends it (end revoked).
+        close: () => appStreams.pulse(userID),
+        // Draining: the stream ends itself on the drain signal (retry:).
+        end: () => {},
+      }
+      listeners.add(listener)
+      return { ready: Promise.resolve(), close: () => void listeners.delete(listener) }
+    },
+    async since(userID, lastID) {
+      if (live) {
+        const missed = await backends.events.since(userID, lastID)
+        return missed && "events" in missed ? missed.events.map(({ id, message }) => ({ id, message })) : undefined
+      }
+      return eventLog.since(userID, lastID)?.map(({ id, message }) => ({ id, message }))
+    },
+    latest: async (userID) => (live ? backends.events.latest(userID) : eventLog.latest(userID)),
+  }
+  /** (AF3) The console's conversation machinery, for the app conversation routes. */
+  const conversationPorts: ConversationPorts = {
+    conversation: (sessionID, on, front, { taps }) => setConversation(sessionID, on, front, undefined, taps),
+    utterance: (sessionID, text, prompt) => sendUtterance(sessionID, text, prompt),
+    interrupt: (sessionID) => interruptSession(sessionID, false),
+    conversationOf: (sessionID) => registry.conversationOf(sessionID),
+    stateOf: (sessionID) => registry.status(sessionID)?.find((s) => s.id === sessionID)?.state ?? "idle",
+  }
+  const agentDeps = { contextCards: cards, conversation: { ports: conversationPorts, source: appStreamSource, streams: appStreams, cookieName: COOKIE, ...options.appStreams }, connect: appConnect, speech: speechDeps, recording: { call: (userID: string, sessionID: string, fields: Parameters<RecordingService["conciergeCall"]>[2]) => recordingService.conciergeCall(userID, sessionID, fields) }, intents, teamDiscovery, draining: drainSignal.signal, store, sessionTokens, directory, registry, spokes, delivery, decisions, messageState: backends.state, feed, heartbeatMs, now, audit, grants, grantRequests, acting, actions, escalate, launches, webhooks, subscriptions, agentEvents, eventCursorKeys: tokenKeys, maxPromptChars: MAX_PROMPT_CHARS, profiles, workspaces, workspaceCheckpoints, teamIntake, graph: { teams: { teams: teamStore, seats: teamSeats! } }, teams: { teams: teamStore, seats: teamSeats!, staffing: teamStaffing }, artifacts: { ...(artifacts && backends.blobs ? { artifacts, blobs: backends.blobs } : {}), state: backends.state, now }, artifactHost: { caps: artifactHostCaps, ...(artifacts ? { artifacts } : {}) }, concierge: { state: backends.state, activity: conciergeActivity, results: conciergeResults, identity: conciergeTimedIdentity, protects: conciergeProtects(conciergeTimedIdentity), service: conciergeService, models: machineModels({ serviceFor: (machineID) => registry.serviceFor(machineID), reportedSessions: (connID) => registry.reportedSessions(connID), request: (connID, req) => spokes.request(connID, req) }), routes: () => [...conciergeParts.tiers.routes(), ...conciergeGrantRequestRoutes({ requests: conciergeGrantRequests, identity: conciergeTimedIdentity })], armed: conciergeArmed, timeZone: conciergeBoardDeps.timeZone, coverage: conciergeCoverage, projectGrant: conciergeProjectGrant } }
   const resolveActor = createResolver({
     cookieName: COOKIE,
     findDevice: (token) => deviceOfToken(token),
@@ -1586,6 +1819,12 @@ export function startCentral(options: CentralOptions): Central {
       }
       if (method === "POST" && pathname === "/cli/login/poll") return await cliLoginPoll((await body(request)).deviceCode)
       if (method === "GET" && pathname === "/spoke/presence") return await spokePresence(request)
+      // (AF1) Connect an app: public OAuth endpoints (never behind the console gate) and the consent page.
+      if (method === "GET" && pathname === CONNECT_PATHS.metadata) return appConnect.metadata()
+      if (method === "GET" && pathname === CONNECT_PATHS.authorize) return await appConnect.authorize(url, addressOf(request, server))
+      if (method === "POST" && pathname === CONNECT_PATHS.token) return await appConnect.token(request, addressOf(request, server))
+      if (method === "POST" && pathname === CONNECT_PATHS.revoke) return await appConnect.revoke(request, addressOf(request, server))
+      if (method === "GET" && CONSENT_PAGE.test(pathname)) return await consentPage(request.headers.get("accept-encoding"))
       if (method === "GET" && pathname === "/.well-known/hub") {
         return wellKnown({ publicURL, version: options.version ?? "0.0.0", auth: config.auth.mode === "oidc" ? { mode: "oidc", issuer: config.auth.issuer } : { mode: "pairing" } })
       }
@@ -1743,6 +1982,16 @@ export function startCentral(options: CentralOptions): Central {
       return Response.json({ prefs }, { headers: NO_STORE })
     }),
     route("GET", "/api/reads", "user", ({ user }) => Response.json({ reads: store.reads(user.id) }, { headers: NO_STORE })),
+    // (Session findability) The user's touched sessions: {activity: {sessionID: {at?, kind?, buckets}}}, and the
+    // stored intents of the user's sessions for the list's second line: {intents: {sessionID: {text, source}}}.
+    route("GET", "/api/activity/mine", "user", async ({ user }) => Response.json({ activity: await humanActivity.list(user.id) }, { headers: NO_STORE })),
+    route("GET", "/api/intents/mine", "user", async ({ user }) =>
+      Response.json({ intents: Object.fromEntries([...(await intents.all(user.id))].map(([id, intent]) => [id, { text: intent.text, source: intent.source }])) }, { headers: NO_STORE })),
+    // (AF1) The consent page's flow: read it, approve with the scopes kept, or deny. Approve and deny need the device
+    // cookie (same origin, checked above), never a device token; a personal client's flow exists only for its owner.
+    route("GET", "/api/connect/flows/:flow", "user", async ({ params, user }) => connectAnswer(async () => Response.json(await appConnect.flowView(user, params.flow!), { headers: NO_STORE }))),
+    route("POST", "/api/connect/flows/:flow/approve", "user", async ({ request, params, user }) => connectDecision(request, user, params.flow!, "approve")),
+    route("POST", "/api/connect/flows/:flow/deny", "user", async ({ request, params, user }) => connectDecision(request, user, params.flow!, "deny")),
     // A CLI login (`hub login`): the user approves it as themselves, with the scopes they tick, or denies it.
     route("GET", "/api/cli-logins/:code", "user", async ({ params }) => {
       const login = await auth.cliLogin(params.code!)
@@ -1784,8 +2033,7 @@ export function startCentral(options: CentralOptions): Central {
       const speech = speechFor(user.id)
       // (REC-01) x-hub-recording (+ x-hub-tts-ref): tts.synth timing; best effort, the audio is never stored.
       const tap = await recordingService.speakTap(user.id, device.id, request.headers, text.length).catch(() => undefined)
-      // Passed through as the provider sends it, so the phone can start playing before synthesis ends.
-      const audio = speech.speakStream ? await speech.speakStream(text, request.signal) : await speech.speak(text)
+      const audio = await speakAudio(speech, text, request.signal)
       return new Response(tap ? tap.wrap(audio) : audio, { headers: { "content-type": "audio/mpeg" } })
     }),
     // (REC-01) Recording routes: console only ("user": the user's cookie or device token), see docs/voice-recording.md.
@@ -1859,6 +2107,20 @@ export function startCentral(options: CentralOptions): Central {
       return Response.json(view, { headers: NO_STORE })
     }),
     // (RF2) The user's media allowlist (Settings → Media) and whether this hub fetches web images at all.
+    // Context cards: the primary card of each listed session (the session list's second line), ≤ 200 IDs.
+    route("GET", "/api/context-cards/primary", "user", async ({ url, user }) => {
+      const ids = (url.searchParams.get("sessions") ?? "").split(",").filter(Boolean)
+      if (ids.length > 200 || ids.some((id) => id.length > 200)) return error(400, "At most 200 session IDs")
+      const found = await cards.primaries(user.id, ids.filter((id) => registry.sessionTenant(id) === undefined || registry.sessionTenant(id) === user.id))
+      return Response.json({ cards: Object.fromEntries(found) }, { headers: NO_STORE })
+    }),
+    route("GET", "/api/settings/context-cards", "user", async ({ user }) => Response.json(await cards.settingsView(user.id), { headers: NO_STORE })),
+    route("PUT", "/api/settings/context-cards", "user", async ({ request, user }) => {
+      const input = await body(request)
+      if (typeof input.enabled !== "boolean" || Object.keys(input).some((k) => k !== "enabled")) return error(400, "Expected {enabled: true | false}")
+      await store.audit({ actor: user.id, action: "context-cards.setting", target: user.id, detail: input.enabled ? "on" : "off" })
+      return Response.json(await cards.setEnabled(user.id, input.enabled), { headers: NO_STORE })
+    }),
     route("GET", "/api/settings/media", "user", ({ user }) => Response.json(mediaSettingsView(user.id), { headers: NO_STORE })),
     route("PUT", "/api/settings/media", "user", async ({ request, user }) => {
       await store.setMediaAllowlist(user.id, mediaSettingsInput(await jsonBody(request)))
@@ -1890,19 +2152,13 @@ export function startCentral(options: CentralOptions): Central {
       return new Response(null, { status: 204 })
     }),
     route("POST", "/api/sessions/:session/turn", "session", ({ request, server, params }) => turn(request, server, params.session!)),
-    route("POST", "/api/sessions/:session/utterance", "session", ({ request, params }) => utterance(request, params.session!), true),
+    route("POST", "/api/sessions/:session/utterance", "session", ({ request, params, device }) => utterance(request, params.session!, device.id), true),
     route(
       "POST",
       "/api/sessions/:session/interrupt",
       "session",
       async ({ params }) => {
-        // (voice front P1) While a front is active, an interrupt stops the front (barge-in), not the session's work.
-        const front = registry.frontRoute(params.session!)
-        // A front that cannot be reached failed: the session talks directly (front_failed), never a 502.
-        const viaFront = front ? await spokes.request(front.connID, { op: "interrupt", sessionID: front.sessionID }).then(() => true, () => (registry.frontLost(params.session!), false)) : false
-        if (!viaFront) await spokes.request(ownerOf(params.session!, "interrupt"), { op: "interrupt", sessionID: params.session! })
-        registry.cancelTurns(params.session!)
-        recordingTap(params.session!, "interrupt", {})
+        await interruptSession(params.session!)
         return new Response(null, { status: 204 })
       },
     ),
@@ -1932,26 +2188,22 @@ export function startCentral(options: CentralOptions): Central {
     route("POST", "/api/sessions/:session/revert", "session", ({ request, params, user }) => revertSession(request, params.session!, user.id)),
     route("POST", "/api/sessions/:session/revert/restore", "session", ({ params, user }) => revertEnd(params.session!, user.id, "revertRestore")),
     route("POST", "/api/sessions/:session/revert/commit", "session", ({ params, user }) => revertEnd(params.session!, user.id, "revertCommit")),
-    route("POST", "/api/sessions/:session/conversation", "session", ({ request, params }) => conversation(request, params.session!), true),
+    route("POST", "/api/sessions/:session/conversation", "session", ({ request, params, user }) => conversation(request, params.session!, user.id), true),
     route("GET", "/api/sessions/:session/models", "session", async ({ params }) =>
       Response.json(await spokes.request(ownerOf(params.session!), { op: "models", sessionID: params.session! }), { headers: NO_STORE })),
-    route("GET", "/api/sessions/:session/model-prefs", "session", async ({ params, user }) => {
-      const prefs = store.modelPrefs(user.id, params.session!)
-      const defaults = await spokes.request(ownerOf(params.session!), {
-        op: "setModelPrefs",
-        sessionID: params.session!,
-        voice: prefs.voice ?? null,
-        worker: prefs.worker ?? null,
-      })
-      return Response.json({ prefs, defaults: defaults.defaults }, { headers: NO_STORE })
-    }),
+    route("GET", "/api/sessions/:session/model-prefs", "session", ({ params, user }) => getModelPrefs(params.session!, user.id)),
     route("PUT", "/api/sessions/:session/model-prefs", "session", async ({ request, params, user }) => {
       const change = modelPrefsInput(await jsonBody(request))
-      await checkModelSelections(ownerOf(params.session!), params.session!, change)
+      // Only an obsolete Worker model (an older console): nothing changes.
+      if (!("voice" in change)) return getModelPrefs(params.session!, user.id)
+      await checkModelSelections(ownerOf(params.session!), params.session!, [change.voice])
       const reply = await spokes.request(ownerOf(params.session!), { op: "setModelPrefs", sessionID: params.session!, ...change })
       const prefs = await store.setModelPrefs(user.id, params.session!, change)
-      return Response.json({ prefs, defaults: reply.defaults }, { headers: NO_STORE })
+      return Response.json({ prefs, defaults: voiceOnly(reply.defaults) }, { headers: NO_STORE })
     }),
+    // The session's own model (feature "setModel"): every later turn runs on it, whoever prompts. Same access as a
+    // prompt (the session's owner); the Voice model above is separate.
+    route("PUT", "/api/sessions/:session/model", "session", async ({ request, params, user }) => setSessionModel(request, params.session!, user.id)),
     route("GET", "/api/sessions/:session/timeline", "session", async ({ params, url }) => {
       const limitRaw = url.searchParams.get("limit")
       const limit = limitRaw === null ? undefined : Number(limitRaw)
@@ -2013,15 +2265,32 @@ export function startCentral(options: CentralOptions): Central {
     route("POST", "/api/sessions/:session/form", "session", ({ request, params, user }) => form(request, params.session!, user.id)),
     route("GET", "/api/sessions/:session/summary", "session", async ({ params }) =>
       Response.json(await spokes.request(ownerOf(params.session!), { op: "summary", sessionID: params.session! }), { headers: NO_STORE })),
+    // Context cards (docs/context-cards.md): a session's cards, and a provider's manual refresh.
+    route("GET", "/api/sessions/:session/context-cards", "session", async ({ params, user }) => Response.json(await cards.view(user.id, params.session!), { headers: NO_STORE })),
+    route("POST", "/api/sessions/:session/context-cards/:provider/refresh", "session", async ({ params, user, request }) => {
+      if (!cards.registry.get(params.provider!)) return error(404, "No such context card")
+      // {force: true} regenerates even when nothing changed (still deduped and rate limited).
+      const input = request.headers.get("content-type")?.includes("json") ? await body(request) : {}
+      const outcome = await cards.refresh(user.id, params.session!, params.provider!, { force: input.force === true })
+      if (outcome.status === "skipped" && outcome.reason === "rate_limited") {
+        const seconds = Math.max(1, Math.ceil((outcome.retryAfterMs ?? 1000) / 1000))
+        return Response.json({ outcome: "skipped", reason: "rate_limited", retryAfter: seconds }, { status: 429, headers: { ...NO_STORE, "retry-after": String(seconds) } })
+      }
+      return Response.json(outcome.status === "generated" ? { outcome: "generated", card: outcome.card } : outcome.status === "skipped" ? { outcome: "skipped", reason: outcome.reason } : { outcome: "failed", error: "The context card could not be made" }, { headers: NO_STORE })
+    }),
     route("GET", "/api/sessions/:session/diff", "session", async ({ params, url }) => {
       const file = url.searchParams.get("file")
       if (!file || file.length > 4096) return error(400, "Expected ?file=<path>")
       const { patch } = await spokes.request(ownerOf(params.session!), { op: "diff", sessionID: params.session!, file })
       return patch ? Response.json(patch, { headers: NO_STORE }) : error(404, "No changes for that file")
     }),
-    route("POST", "/api/sessions/:session/read", "session", async ({ params, user, device }) => {
+    route("POST", "/api/sessions/:session/read", "session", async ({ params, user, device, request }) => {
       const reads = await store.markRead(user.id, params.session!, Date.now())
       toUser(user.id, { type: "reads", reads }, device.id)
+      // Only an explicit open (navigating to it, the page or pane shown again) touches the session, never the
+      // console's automatic read marks of a visible pane (the touch also feeds the context cards' user-return).
+      const input = await body(request).catch(() => ({}) as Record<string, unknown>)
+      if (input.open === true) humanActivity.human(user.id, registry.rootOf(params.session!) ?? params.session!, "view")
       return Response.json({ reads }, { headers: NO_STORE })
     }),
 
@@ -2166,6 +2435,22 @@ export function startCentral(options: CentralOptions): Central {
     return new Response(null, { status: 204 })
   }
 
+  /** A connect-flow handler's AgentError as the console's error envelope. */
+  async function connectAnswer(run: () => Promise<Response>): Promise<Response> {
+    try {
+      return await run()
+    } catch (cause) {
+      if (cause instanceof AgentError) return error(AGENT_ERROR_STATUS[cause.code], cause.message, cause.code, NO_STORE)
+      throw cause
+    }
+  }
+
+  async function connectDecision(request: Request, user: UserRecord, flow: string, decision: "approve" | "deny"): Promise<Response> {
+    if ((await resolveActor.mode(request)) !== "cookie") return error(403, "Approve or deny on the hub's consent page", "forbidden")
+    const input = await body(request)
+    return connectAnswer(async () => Response.json(await appConnect.decide(user, flow, decision, input.scopes), { headers: NO_STORE }))
+  }
+
   async function decideCliLogin(code: string, status: "approved" | "denied", user: UserRecord, scopes?: unknown): Promise<Response> {
     const clientName = await auth.decideCliLogin(code, status, user.id, scopes)
     if (clientName === undefined) return error(404, "No pending CLI login with that code")
@@ -2386,6 +2671,27 @@ export function startCentral(options: CentralOptions): Central {
     })
   }
 
+  /**
+   * PUT /api/sessions/:id/model {model}: 400 for a malformed body or a model (variant) the session's catalog lacks,
+   * 409 unsupported when its spoke did not announce setModel (an older plugin: the console's chip stays display only).
+   */
+  async function setSessionModel(request: Request, sessionID: string, userID: string): Promise<Response> {
+    const model = sessionModelInput(await jsonBody(request))
+    const connID = ownerOf(sessionID)
+    if (!registry.supports(connID, "setModel")) throw unsupportedError({ feature: "setModel", harness: registry.harnessOf(connID) ?? "unknown" })
+    await checkModelSelections(connID, sessionID, [model])
+    const result = await spokes.request(connID, { op: "setModel", sessionID, model })
+    await store.audit({ actor: userID, action: "session.model", target: sessionID, detail: `${model.providerID}/${model.modelID}${model.variant ? `#${model.variant}` : ""}` })
+    return Response.json({ model: result.model }, { headers: NO_STORE })
+  }
+
+  /** A session's Voice model preference, re-sent to its spoke (which answers with its defaults). */
+  async function getModelPrefs(sessionID: string, userID: string): Promise<Response> {
+    const prefs = store.modelPrefs(userID, sessionID)
+    const reply = await spokes.request(ownerOf(sessionID), { op: "setModelPrefs", sessionID, voice: prefs.voice ?? null })
+    return Response.json({ prefs, defaults: voiceOnly(reply.defaults) }, { headers: NO_STORE })
+  }
+
   /**
    * GET …/timeline/messages/:message/media/:ref (S4 M3): 400 for a malformed ref or message ID, 409 offline, 422
    * unsupported {feature, harness} when the owning spoke did not announce timelineMedia; else ./media-timeline.ts.
@@ -2417,8 +2723,8 @@ export function startCentral(options: CentralOptions): Central {
    * Every selection must be in the session's catalog (provider, model and variant), so a typo cannot leave
    * the session failing every turn. A catalog that cannot be fetched is a 502, never an accepted selection.
    */
-  async function checkModelSelections(connID: string, sessionID: string, change: { voice?: ModelSelection | null; worker?: ModelSelection | null }): Promise<void> {
-    const selections = [change.voice, change.worker].filter((m): m is ModelSelection => !!m)
+  async function checkModelSelections(connID: string, sessionID: string, picked: ReadonlyArray<ModelSelection | null | undefined>): Promise<void> {
+    const selections = picked.filter((m): m is ModelSelection => !!m)
     if (selections.length === 0) return
     let models: readonly AvailableModel[]
     try {
@@ -2514,19 +2820,55 @@ export function startCentral(options: CentralOptions): Central {
     if (tenant !== undefined) recordingService.hub(tenant, sessionID, kind, fields)
   }
 
+  /** Barge-in; `taps` false (AF3, an app): REC-01's recording taps are left out. */
+  async function interruptSession(sessionID: string, taps = true): Promise<void> {
+    // (voice front P1) While a front is active, an interrupt stops the front (barge-in), not the session's work.
+    const front = registry.frontRoute(sessionID)
+    // A front that cannot be reached failed: the session talks directly (front_failed), never a 502.
+    const viaFront = front ? await spokes.request(front.connID, { op: "interrupt", sessionID: front.sessionID }).then(() => true, () => (registry.frontLost(sessionID), false)) : false
+    if (!viaFront) await spokes.request(ownerOf(sessionID, "interrupt"), { op: "interrupt", sessionID })
+    registry.cancelTurns(sessionID)
+    if (taps) recordingTap(sessionID, "interrupt", {})
+  }
+
   /** Conversation mode: steer the utterance into the session (allowed while it is busy) and return at once. */
-  async function utterance(request: Request, sessionID: string): Promise<Response> {
+  async function utterance(request: Request, sessionID: string, deviceID?: string): Promise<Response> {
     const raw = (await body(request)).text
     const text = typeof raw === "string" ? raw.trim() : ""
     if (!text) return error(400, "Empty utterance")
     if (text.length > MAX_UTTERANCE_CHARS) return error(400, `Utterance longer than ${MAX_UTTERANCE_CHARS} characters`)
+    return Response.json({ inboxID: await sendUtterance(sessionID, text, undefined, deviceID) }, { status: 202 })
+  }
+
+  /**
+   * An utterance to the session, or to its voice front while one is active (it relays it); tracked for `heard`.
+   * Without `prompt`: the console's steer (the user's own voice: a human turn, recorded by REC-01's taps). (AF3) With
+   * `prompt`: an app's, delivered as an agent prompt with its hub-prompt provenance (from app:<id>, the grant),
+   * steered into the running turn; no human turn, nothing recorded (REC-01 is off for apps).
+   */
+  async function sendUtterance(sessionID: string, text: string, prompt?: { readonly from: string; readonly to: string; readonly grant: string }, deviceID?: string): Promise<string> {
+    const send = async (connID: string, target: string): Promise<string> => {
+      if (!prompt) return (await spokes.request(connID, { op: "steer", sessionID: target, text })).inboxID
+      for (const feature of ["deliver", "hubPrompt"] as const) {
+        if (!registry.supports(connID, feature)) throw unsupportedAgentError(feature, registry.harnessOf(connID) ?? "unknown")
+      }
+      const messageID = newMessageID()
+      const result = await spokes.request(connID, { op: "deliver", sessionID: target, messageID, text, wake: true, meta: { kind: "prompt", from: prompt.from, to: prompt.to, grant: prompt.grant, delivery: "steer" } })
+      if (!isDeliverResult(result)) throw new Error("The spoke answered a deliver malformed")
+      return result.inboxID ?? messageID
+    }
     // (voice front P1) While a front is active, utterances go to the front; it relays them to the session.
     const front = registry.frontRoute(sessionID)
-    await humanTurn(sessionID)
+    if (!prompt) {
+      await humanTurn(sessionID)
+      // The steer comes back from the spoke marked carried: it is recorded here once, as Voice.
+      const speaker = registry.sessionTenant(sessionID)
+      if (speaker !== undefined) humanActivity.human(speaker, registry.rootOf(sessionID) ?? sessionID, "voice")
+    }
     // A front that cannot take it failed: the session talks directly (front_failed), never a 502.
     let inboxID = front
-      ? await spokes.request(front.connID, { op: "steer", sessionID: front.sessionID, text }).then(
-          (result) => result.inboxID,
+      ? await send(front.connID, front.sessionID).then(
+          (id) => id,
           (cause) => {
             console.warn(`[hub] voice front of ${sessionID} did not take the utterance: ${(cause as Error).message}`)
             registry.frontLost(sessionID)
@@ -2534,10 +2876,13 @@ export function startCentral(options: CentralOptions): Central {
           },
         )
       : undefined
-    if (inboxID === undefined) inboxID = (await spokes.request(ownerOf(sessionID, "steer"), { op: "steer", sessionID, text })).inboxID
-    recordingTap(sessionID, "utterance.received", { inboxID, text })
+    // (P2) What the user said to the front: the only thing its relay_to_session may answer. Never an app's text
+    // (AF3): an app's words never become the user's own for a relay.
+    if (inboxID !== undefined && !prompt) registry.frontUtterance(sessionID, inboxID, deviceID, text)
+    if (inboxID === undefined) inboxID = await send(prompt ? ownerOf(sessionID) : ownerOf(sessionID, "steer"), sessionID)
+    if (!prompt) recordingTap(sessionID, "utterance.received", { inboxID, text })
     registry.trackUtterance(sessionID, inboxID)
-    return Response.json({ inboxID }, { status: 202 })
+    return inboxID
   }
 
   /** Renames a session in OpenCode through its owner process, falling back to other processes that report it. */
@@ -2588,12 +2933,27 @@ export function startCentral(options: CentralOptions): Central {
     throw failure
   }
 
-  async function conversation(request: Request, sessionID: string): Promise<Response> {
+  async function conversation(request: Request, sessionID: string, userID: string): Promise<Response> {
     const input = await body(request)
     const on = input.on
     if (typeof on !== "boolean" || (input.front !== undefined && typeof input.front !== "boolean")) return error(400, "Expected {on: boolean, front?: boolean}")
-    // (voice front P1) `front`: put a hidden voice front in front of the session, when its spoke serves it.
-    const wantsFront = on && input.front === true
+    return Response.json(await setConversation(sessionID, on, input.front, userID))
+  }
+
+  /**
+   * Conversation mode on/off. Console (`userID` given): Voice mode always asks for the voice front (when the
+   * session's spoke serves it), unless the device opted out with `front: false`; a console that sends no `front`
+   * (older ones, the TUI's /voice link) gets the default. (AF3) An app (`userID` undefined, `taps` false): the front
+   * only when asked for (`front: true`), never the Concierge's front (its relay_to_session acts as the user), and
+   * REC-01's recording taps are left out (off for apps).
+   */
+  async function setConversation(sessionID: string, on: boolean, frontInput: boolean | undefined, userID?: string, taps = true): Promise<{ on: boolean; agent?: string; front?: boolean }> {
+    const app = userID === undefined
+    const asked = app ? frontInput === true : frontInput !== false
+    const owner = userID ?? registry.sessionTenant(sessionID)
+    // (P2) The Concierge's front only from a spoke that serves it ("conciergeFront"); else today's path, no front.
+    const concierge = on && asked && owner !== undefined && (await conciergeTimedIdentity.current(owner).then((c) => c.sessionID === sessionID, () => false))
+    const wantsFront = on && asked && (!concierge || (!app && registry.supports(ownerOf(sessionID), "conciergeFront")))
     const hadFront = registry.wantsFront(sessionID)
     // Turning off always clears the hub's state, so a later reconnect does not switch it back on.
     if (!on) registry.setConversation(sessionID, false)
@@ -2613,8 +2973,95 @@ export function startCentral(options: CentralOptions): Central {
       if (sendFront) registry.frontOpEnded(connID)
     }
     const front = registry.frontOf(sessionID) !== undefined
-    if (on && tenant !== undefined) recordingTap(sessionID, "conversation", { on: true, ...(wantsFront ? { front } : {}) })
-    return Response.json({ on, agent: result.agent, ...(wantsFront || (!on && hadFront) ? { front } : {}) })
+    if (taps && on && tenant !== undefined) recordingTap(sessionID, "conversation", { on: true, ...(wantsFront ? { front } : {}) })
+    return { on, ...(typeof result.agent === "string" ? { agent: result.agent } : {}), ...(wantsFront || (!on && hadFront) ? { front } : {}) }
+  }
+
+  /**
+   * (voice front P2) A Concierge front's relay_to_session (spoke request relayToSession from `connID`, a machine of
+   * `owner`): enforced here, not only by the front's prompt. The front must be the active front of the owner's
+   * current Concierge, linked by `connID`, answering the user's latest utterance to it (RELAYS_PER_UTTERANCE at
+   * most); the target one of the owner's own, live, visible root sessions (no front, no Concierge session). It runs
+   * as the user's own prompt (no grant, no Decision): steered into a busy session, a turn in an idle one; text only,
+   * so the target's own permissions apply. Audited as the user's prompt with RELAY_REASON. A refusal throws (the
+   * spoke's ok:false, read back to the front).
+   */
+  async function relayToSession(owner: string, connID: string, req: { readonly frontID: string; readonly session: string; readonly text: string; readonly previous?: boolean; readonly confirm?: boolean }): Promise<ResultFor["relayToSession"]> {
+    const refuse = (message: string): never => {
+      throw new RelayRefused(message)
+    }
+    // (hardening) Every refusal of the hub's checks is in the audit (Activity shows attempts), as the user's refused
+    // prompt with the reason, the target when it was resolved and the device when the utterance is known.
+    let audited: { sessionID?: string; deviceID?: string } = {}
+    const refused = async (cause: unknown) => {
+      if (!(cause instanceof RelayRefused)) return
+      await audit
+        .record(owner, {
+          actor: { kind: "user" },
+          verb: "prompt",
+          target: audited.sessionID ? { sessionID: audited.sessionID } : {},
+          decision: /at most \d+/.test(cause.message) ? "rate_limited" : "forbidden",
+          reason: `Relay by voice refused: ${cause.message}`,
+          outcome: "refused",
+          ...(audited.deviceID ? { deviceID: audited.deviceID } : {}),
+        })
+        .catch((e: unknown) => console.error(`[hub] relay audit failed: ${(e as Error).message}`))
+    }
+    let binding: ReturnType<typeof registry.takeRelay>
+    try {
+      binding = registry.takeRelay(connID, req.frontID)
+    } catch (cause) {
+      if (cause instanceof RelayRefused && cause.deviceID) audited = { deviceID: cause.deviceID }
+      await refused(cause)
+      throw cause
+    }
+    audited = binding.deviceID ? { deviceID: binding.deviceID } : {}
+    try {
+      if (registry.sessionTenant(binding.mainID) !== owner) refuse("Not an active voice front")
+      const identity = await conciergeTimedIdentity.current(owner)
+      if (identity.sessionID !== binding.mainID) refuse("Only the Concierge's voice front relays to other sessions")
+      let sessionID = ""
+      try {
+        sessionID = directory.resolveOne(owner, req.session).sessionID
+      } catch (cause) {
+        refuse(cause instanceof Error ? cause.message : `No session ${req.session}`)
+      }
+      if (registry.sessionTenant(sessionID) !== owner) refuse(`${req.session} is not one of yours`)
+      audited = { ...audited, sessionID }
+      if (sessionID === binding.mainID || registry.hidden(sessionID) || identity.hiddenSessionIDs.includes(sessionID)) refuse("That session takes no relays (a voice front or the Concierge): pass the request to the Concierge instead")
+      const live = registry.session(sessionID) ?? refuse(`${req.session} is offline`)
+      if ((registry.rootOf(sessionID) ?? sessionID) !== sessionID) refuse("Relays go to root sessions, not to subagent sessions")
+      const engine = conciergeActing ?? refuse("This hub cannot relay right now")
+      const actor = { kind: "user" as const, userID: owner, deviceID: binding.deviceID ?? "", via: "cookie" as const }
+      // (hardening, rounds 4 and 5) Only the user's own words, from the hub's record of the utterance: the front's text
+      // is never delivered (board text steering the front, or a restated or inverted request, never reaches the session).
+      if (!binding.words.trim()) refuse("The hub has no words of the user's to relay")
+      const previous = req.previous && binding.previous ? binding.previous : undefined
+      // (hands-on) A question ABOUT a session is not a request FOR it: the front answers or asks the Concierge. For a
+      // redirect ("no, the other one?") the earlier request is the one checked.
+      const question = relayQuestionProblem(previous ?? binding.words)
+      // (guard tuning) A question with a work verb is refused softly: the front may retry ONCE with confirm, for the same
+      // utterance and the same session (after saying aloud what it sends). A hard refusal is never confirmable.
+      let confirmed = false
+      if (question && req.confirm) {
+        if (binding.softTarget !== sessionID) refuse("confirm: true is only for one retry of the same request to the same session, right after the hub's question check offered it. Answer the user or pass it to the Concierge")
+        binding.useConfirm()
+        confirmed = true
+      } else if (question) {
+        if (question === STATUS_QUESTION_SOFT_REFUSAL) binding.markSoft(sessionID)
+        refuse(question)
+      }
+      const { message } = relayMessage({ words: binding.words, ...(previous ? { previous } : {}) })
+      const prompted = await engine.prompt({ actor, userID: owner, auditDevice: true }, sessionID, { text: message, why: confirmed ? RELAY_REASON_CONFIRMED : RELAY_REASON })
+      const title = live.title?.trim() || "The session"
+      const steered = "mode" in prompted && prompted.mode === "steer"
+      registry.noteRelay(binding.mainID, sessionID, title, steered && "inboxID" in prompted ? prompted.inboxID : undefined)
+      return { sessionID, title, mode: steered ? "steer" : "turn" }
+    } catch (cause) {
+      binding.release()
+      await refused(cause)
+      throw cause
+    }
   }
 
   /** Enables or disables voice for a session, through a process that reported it (service first). */
@@ -2681,6 +3128,7 @@ export function startCentral(options: CentralOptions): Central {
     const answered = await actions.answerPermission({ rootID, requestID: input.requestID, decision })
     if (answered.outcome === "unsupported") throw unsupportedError(answered)
     if (answered.outcome === "done") auditUserAnswer(userID, decision === "reject" ? "deny" : "approve", { sessionID: asking, requestID: input.requestID })
+    if (answered.outcome === "done") humanActivity.human(userID, registry.rootOf(rootID) ?? rootID, "answer")
     return answered.outcome === "done" ? new Response(null, { status: 204 }) : error(409, PERMISSION_GONE, "gone")
   }
 
@@ -2700,6 +3148,7 @@ export function startCentral(options: CentralOptions): Central {
     )
     if (answered.outcome === "unsupported") throw unsupportedError(answered)
     if (answered.outcome === "done") auditUserAnswer(userID, "answer", { sessionID: asking, formID: input.formID })
+    if (answered.outcome === "done") humanActivity.human(userID, registry.rootOf(rootID) ?? rootID, "answer")
     return answered.outcome === "done" ? new Response(null, { status: 204 }) : error(409, PERMISSION_GONE, "gone")
   }
 
@@ -2893,6 +3342,16 @@ export function startCentral(options: CentralOptions): Central {
     return done
   }
 
+  /** The consent page (the console's SPA) can never be framed, whatever HUB_CSP says. */
+  async function consentPage(acceptEncoding: string | null): Promise<Response> {
+    const page = await staticFile("/", acceptEncoding)
+    const headers = new Headers(page.headers)
+    headers.set("x-frame-options", "DENY")
+    headers.set("cache-control", "no-store")
+    if (!headers.has("content-security-policy")) headers.set("content-security-policy", "frame-ancestors 'none'")
+    return new Response(page.body, { status: page.status, headers })
+  }
+
   async function staticFile(pathname: string, acceptEncoding: string | null): Promise<Response> {
     const name = APP_ROUTES.test(pathname) ? "index.html" : STATIC_PATH.test(pathname) ? pathname.slice(1) : undefined
     const type = name && CONTENT_TYPES[path.extname(name).toLowerCase()]
@@ -2940,11 +3399,13 @@ export function startCentral(options: CentralOptions): Central {
     launchFeed,
     launchTokens,
     webhooks,
+    subscriptions,
     agentEvents,
     directory,
     concierge: conciergeService,
     agentEventWriters,
     intentRetention,
+    contextCards: cards,
     recordings: recordingService,
     teams: { store: teamStore, seats: teamSeats, staffing: teamStaffing, intake: teamIntake },
     routes: [...routes.map(({ method, path, access }) => ({ method, path, access })), ...agent.routes.map(({ method, path }) => ({ method, path, access: "agent" as const }))],
@@ -2956,6 +3417,8 @@ export function startCentral(options: CentralOptions): Central {
       // Step down first (releasing the leases), so another pod takes the timed jobs over at once.
       await Promise.allSettled([...leaders.map((loop) => loop.stop()), recommendations?.stop()])
       launches.shutdown()
+      // Bounded: a hanging store never holds the shutdown (HumanActivity.stop gives up after its timeout).
+      await humanActivity.stop(HUMAN_ACTIVITY_STOP_MS)
       conciergeSupervisor.stop()
       conciergeContext.stop()
       conciergeParts.tiers.stop?.()
@@ -3098,8 +3561,17 @@ function viewPrefsInput(value: unknown): Partial<ViewPrefs> {
 }
 
 const MODEL_ID = /^[A-Za-z0-9_.:@/+~-]{1,300}$/
-function modelPrefsInput(value: unknown): { voice?: ModelSelection | null; worker?: ModelSelection | null } {
-  const invalid = () => new HttpError(400, "Expected Voice/Worker model selections")
+/** A spoke's model defaults without the obsolete Worker model (older spokes still report one). */
+function voiceOnly(defaults: SessionModelPrefs): SessionModelPrefs {
+  return defaults.voice ? { voice: defaults.voice } : {}
+}
+
+/**
+ * The Voice model selection (the voice front's). `worker` (the removed voice agent's worker model, sent by older
+ * consoles) is validated and dropped.
+ */
+function modelPrefsInput(value: unknown): { voice?: ModelSelection | null } {
+  const invalid = () => new HttpError(400, "Expected a Voice model selection")
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw invalid()
   const record = value as Record<string, unknown>
   if (Object.keys(record).some((key) => key !== "voice" && key !== "worker")) throw invalid()
@@ -3114,7 +3586,19 @@ function modelPrefsInput(value: unknown): { voice?: ModelSelection | null; worke
     out[key] = { providerID: m.providerID, modelID: m.modelID, ...(typeof m.variant === "string" ? { variant: m.variant } : {}) }
   }
   if (!("voice" in out) && !("worker" in out)) throw invalid()
-  return out
+  return "voice" in out ? { voice: out.voice! } : {}
+}
+
+/** The body of PUT /api/sessions/:id/model: {model: {providerID, modelID, variant?}}; other keys inside `model` are dropped. */
+function sessionModelInput(value: unknown): ModelSelection {
+  const invalid = () => new HttpError(400, "Expected {model: {providerID, modelID, variant?}}")
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw invalid()
+  const record = value as Record<string, unknown>
+  if (Object.keys(record).some((key) => key !== "model")) throw invalid()
+  const m = record.model as Record<string, unknown> | null | undefined
+  if (typeof m !== "object" || m === null || Array.isArray(m)) throw invalid()
+  if (typeof m.providerID !== "string" || !MODEL_ID.test(m.providerID) || typeof m.modelID !== "string" || !MODEL_ID.test(m.modelID) || (m.variant !== undefined && (typeof m.variant !== "string" || !MODEL_ID.test(m.variant)))) throw invalid()
+  return { providerID: m.providerID, modelID: m.modelID, ...(typeof m.variant === "string" && m.variant !== "default" ? { variant: m.variant } : {}) }
 }
 
 function param(raw: string): string {
@@ -3141,6 +3625,11 @@ async function boundedBytes(request: Request, max: number, tooLarge: string): Pr
   throw new HttpError(413, tooLarge, undefined, read.close)
 }
 
+/** Passed through as the provider sends it, so the phone (or app) can start playing before synthesis ends. */
+function speakAudio(speech: Speech, text: string, signal: AbortSignal): Promise<ReadableStream<Uint8Array> | Uint8Array<ArrayBuffer>> {
+  return speech.speakStream ? speech.speakStream(text, signal) : speech.speak(text)
+}
+
 /** A console/public JSON body (a SyntaxError for invalid JSON, as request.json() threw). */
 async function jsonBody(request: Request): Promise<unknown> {
   return JSON.parse(Buffer.from(await boundedBytes(request, CONSOLE_JSON_BODY_MAX, `Request body too large (at most ${CONSOLE_JSON_BODY_MAX} bytes)`)).toString("utf8"))